API keys, OAuth apps and webhooks

API keys and scopes

• Full access — read and write everything (what Zapier needs to create tasks).
• Read only — GET requests only. Use it for reporting and BI.
• Per area — e.g. schedule:write + money:read. Areas: schedule, field, money, crm, people, reports, ai, admin.

OAuth apps (client credentials)

1. Settings → API & webhooks → OAuth apps → Register app.
2. Pick scopes and token lifetime. Copy the client secret — shown once.
3. Your app calls POST /api/v1/oauth/token with grant_type=client_credentials and gets a Bearer token.
4. Revoke the app any time; its tokens stop working immediately.

Webhooks

Subscribe a URL to events like task.updated or assignment.confirmed. Each delivery is signed (X-SubText-Signature) and retried with backoff. The full API reference is at /api/v1/openapi.json.